nx show projects --affected hangs forever in a Linux CI container after the upgrade from 23.1.0 to 23.1.1

[ryandegruyter]

Current Behavior

The command pnpm exec nx show projects --affected --base=origin/main hangs forever on nx 23.1.1. The hang occurs in a containerized Linux CI runner with a cold project graph. The command gives no output before the hang. The CI job dies on its 10-minute limit. We measured a hang of more than 13 minutes.

The environment variables NX_DAEMON=false and NX_NO_CLOUD=true do not prevent the hang. The variable NX_ISOLATE_PLUGINS=false prevents the hang. With this variable, the same command completes in 25 seconds on the same runner.

Expected Behavior

The command must complete in less than one minute, as it does on nx 23.1.0. On nx 23.1.0, with default settings, the same command completes in 40 to 44 seconds on the same runner.

GitHub Repo

No response (private monorepo — we cannot share it)

Steps to Reproduce

1. Use a large pnpm monorepo. Ours has 407 projects and registers @nx/jest/plugin and @nx/eslint/plugin in nx.json.
2. Run a CI job in a containerized Linux runner. We use GitHub Actions with Actions Runner Controller on Kubernetes.
3. Restore node_modules from a cache. Make sure that the nx workspace-data cache is cold.
4. Run pnpm exec nx show projects --affected --base=origin/main.
5. On nx 23.1.1, the command hangs with no output.
6. Set NX_ISOLATE_PLUGINS=false and run the command again. It completes in approximately 25 seconds.
7. Pin nx and the @nx/* plugins back to 23.1.0 and run the command again. It completes in approximately 40 seconds.

The problem does not occur on macOS (darwin-arm64), also not with a cold cache after nx reset.

We isolated the variables in five CI runs on the same day, on the same runner class:

Workspace state	nx	Plugin isolation	Result
identical	23.1.0	on (default)	completes in 40-44s
identical	23.1.1	on (default)	hangs, no output, > 13 min
identical	23.1.1	on, with NX_DAEMON=false + NX_NO_CLOUD=true	hangs, no output, > 13 min
identical	23.1.1	off (NX_ISOLATE_PLUGINS=false)	completes in 25s
identical	23.1.0	off (NX_ISOLATE_PLUGINS=false)	completes in 33s

Only the nx version and the isolation flag change the outcome.

Nx Report

Node           : 24.16.0
OS             : linux-x64 (glibc), Kubernetes container
pnpm           : 11.11.0

nx                     : 23.1.1
@nx/js                 : 23.1.1
@nx/eslint             : 23.1.1
@nx/workspace          : 23.1.1
@nx/angular            : 23.1.1
@nx/jest               : 23.1.1
@nx/cypress            : 23.1.1
@nx/devkit             : 23.1.1
@nx/eslint-plugin      : 23.1.1
@nx/module-federation  : 23.1.1
@nx/next               : 23.1.1
@nx/node               : 23.1.1
@nx/react              : 23.1.1
@nx/rollup             : 23.1.1
@nx/rspack             : 23.1.1
@nx/storybook          : 23.1.1
@nx/vite               : 23.1.1
@nx/vitest             : 23.1.1
@nx/web                : 23.1.1
@nx/webpack            : 23.1.1
@nx/docker             : 23.1.1
nx-cloud               : 19.1.3
typescript             : 6.0.3
---------------------------------------
Registered Plugins:
@nx/jest/plugin
@nx/eslint/plugin
---------------------------------------
Community plugins:
@ng-bootstrap/ng-bootstrap : 21.0.0
@storybook/angular         : 10.5.5

Note: we generated this report on a macOS checkout of the same commit and corrected the Node and OS lines to the CI values. The ephemeral CI container is gone.

Failure Logs

The hang produces no output. The calling script logs its marker line, then nothing follows:

  [api-check] Resolving affected projects via nx...
  (no further output for 13+ minutes, then the CI job dies on its timeout)

A SIGTERM to the pnpm process does not end the hang. The nx child processes
survive and keep the stdio pipes open. Only a SIGKILL to the detached process
group ends them.

Package Manager Version

pnpm 11.11.0

Operating System

• macOS
• Linux
• Windows
• Other (Please specify)

Additional Information

Our nightly CI ran this command daily. It was stable on nx 23.1.0 up to 2026-08-04. The first run after the upgrade to 23.1.1 hung, with no other change in the workspace. A pure control run with the identical workspace, the identical runner class, and only nx pinned back to 23.1.0 completed in 40 seconds on the same day as two hangs on 23.1.1. This rules out an environment change on our side.

Two 23.1.1 changes look related to the process handling of plugin workers: "close daemon log descriptors after spawn to avoid Node 26 crash" and the changed git-revision handling for affected commands. Also, 23.1.0 added sandbox detection that disables the daemon and plugin isolation on Linux. This suggests a known hang class for isolation workers in restricted environments. Our runner is a Kubernetes container, and the detection possibly does not cover it.

Our workaround: we run one-shot nx queries in CI with NX_ISOLATE_PLUGINS=false, a hard timeout, and a process-group kill.